Re: Encrypted cookies

[Lucas Oman <me () lucasoman com>]

Ron wrote:
> me why, it's a long story). So here's what they propose: to take the 
> username, hash of the password, and date the user logged in, encrypt 
> them with a strong encryption algorithm, and store them in a cookie 
> (along with a hash to ensure integrity).

Be sure to include a server-side secret string in the hash so that the 
data can't be altered, re-encrypted, and re-hashed to appear as if 
integrity had been maintained. Also, a quick expiry of the cookie, 
enforced by the server using a timestamp stored in the encrypted string, 
can mitigate the risk of replay attacks.


Lucas

--
Web Software Dev
Consultant
Nerd
912.655.9594
www.lucasoman.com

-------------------------------------------------------------------------
Sponsored by: Watchfire 
Methodologies & Tools for Web Application Security Assessment 
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today! 

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------